CVE-2026-114653: CWE-185: Incorrect Regular Expression in MongoDB C# Driver
Description
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
CVSS v4.0
Score 7.1high
Affected software
MongoDB
C# Driver
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MongoDB C# Driver's client-side encryption schema construction component improperly places caller-supplied field identifiers into a pattern expression context without normalization or validation. This incorrect regular expression handling (CWE-185) can cause the encryption rules to fail silently, allowing data intended for encryption to be stored and returned unencrypted. The vulnerability affects versions >=3.5.0 and <3.13.0. The issue requires no user action to manifest, and unauthorized parties with read access to the database can see unprotected data despite the presence of encryption keys.
Potential Impact
Sensitive data that is intended to be encrypted at the client side may be stored and transmitted in cleartext due to the failure of the encryption schema to apply correctly. This exposure allows any party with read access to the stored data to view unencrypted sensitive information without needing the encryption keys. This undermines the confidentiality guarantees of client-side field-level encryption in affected MongoDB C# Driver versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review their use of client-side field-level encryption with the MongoDB C# Driver and consider alternative protective measures or avoid affected versions. Monitor the MongoDB vendor advisories for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-10-21T21:57:54.563Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada649f4d27ba8daa755e48
Added to database: 10/22/2026, 19:31:43 UTC
Last enriched: 10/22/2026, 20:45:58 UTC
Last updated: 10/22/2026, 22:02:11 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.